The Security Skeptic

Lessons from the Field: Managing Adversociates

Frienemy (frenemy) - according to Wikipedia, a portmanteau of "friend" and "enemy"

Everyone has frienemies  in their lives.Frienemies come in a variety of shapes and sizes. Best friends for life who envy you and (sub)consciously want you to fail. Enemies who befriend you to earn your trust while they learn enough about you to ruin your life. Frienemies are not relationships you want or seek and there are dozens of sites purporting ways to keep frienemies at bay.

Many of the measures you can take to minimize your exposure to frienemies don't apply in the workplace. You can't always choose your associates or team mates. Invariably, you'll encounter situations where associates are adversaries, competing against you for recognition, advancement, or continued employment. Some adversociates simply have a different (and often unflinching) perspective regarding a project, deliverable, or product. No matter what the shape or form, you can't rid your life of adversociates as easily (easily?) as you would a frienemy.

Consultants can choose clients, but may encounter adversociates among their clients' staff or 3rd party service providers *after* accepting the work. Such folks may be indignant or fearful of what a consultant will recommend, or how the consultant's recommendations will affect recognition, advancement, budget, and span of control. Unless a consultant manages relationships early in the engagement process, such adversociates can challenge consultants every step along the way. The best case scenario resulting from "adversociates run amok" is needless delay in meeting the client's expectations. The worst case is that the consultant will fail to deliver the work product he was contracted to provide.
 
I'm no expert in managing business relationships; however, I will share four strategies I used to preempt adversociate behavior when I've initially engaged with staff whom I would work closely on projects. I learned more than a few of these working with or observing my longtime business partner and friend, Lisa Phifer.

Listen twice as much as you speak. I can't find a definitive origin for this excellent advice, but it works to my advantage. Give everyone an opportunity to express opinions and concerns. You'll learn about personalities, expertise, agendae, alliances and competing factions and more. The more you know about the parties involved in the project, the better.

Learn the roles each staff member plays. Ask staff members to explain what they do, why they are involved in the project, and what contribution they hope to make. Convey to each staffer that you'll treat him as the SME for the knowledge he professes to have. Make him feel engaged and accountable for providing information and support.

Get your hands dirty. As a technology consultant, look for opportunities for IT staff to show you their shop. Listen carefully while they give you a hard look under the hood. As hokey as it sounds, this techie bonding really helps on projects where you'll have to compete for time and attention with daily operations priorities. Such opportunities also expose you to operational practices, corporate culture, or work flows in an unthreatening atmosphere, where you can observe or collect information that may ultimately shape or influence a client deliverable.

Be honest about the limitations of your expertise. IT folks are mostly hard to bluff and rather unforgiving if you bluff and fail. Conversely, you'll rarely be treated gruffly if you say, "I'm not familiar with that but it sounds really interesting. Explain..."

Develop and stick to a game plan. My notion of a positive consulting outcome includes the following: the client's objectives were met, I learned something new, I was able to expand my network of technology buffs, and I had fun along the way.

Just as everyone has frenemies in their lives, most everyone will encounter adversociates at some point during their career. By recognizing and turning would be adversociates into colleagues, I'm confident I've encountered fewer than I would have.

Zeus Trojans - worst threat yet?

Laura Mather and her Silvertail Systems colleagues have recorded two very fine webinars on Man in the Brower (MitB) attacks  and the Zeus Trojan. A Man in the Browser attack is one in which a trojan program on a compromised computer is able to capture information a user types into browser forms and intercept then modify content a web server attempts to display to the user. Zeus is a particularly insidious trojan because it is allows attackers to customize MitB attacks against specific targets (largely financial institutions) and to defeat both two-factor authentication and machine ID authentication measures. Based on some statistics Laura presents during the Zeus Trojan webinar, you quickly appreciate why I call it insidious: as a result of customization, Zeus is not one but nearly 800 botnets spanning ~1.6 M bot hosts and attacking over 1100 brands, 85% of which are financial institutions.

Laura recently asked APWG colleagues to comment on the suggestion that “trojans like Zeus are the biggest threat to small business in the last decade”. I'd say that Zeus is the most recent but not nearly the last biggest threat to small business. My experience is that small business networking and security differ very little from residential broadband and differ *dramatically* from medium to large enterprise. Common attributes of small business networking and security I’ve encountered include:

• very little if any in-house networking or security expertise 
• employees are not sophisticated users 
• employees receive little or no training and have little or no security awareness beyond “I run antivirus so I’m safe from all that”.
• the security or professional services small businesses can afford are not as competent as medium/large enterprise IT staff or  the consulting services medium/large enterprises can engage 
• the security networking technology small businesses invest in is often residential quality, freeware, or a modest increment (i.e., from a $100 broadband firewall/router to a $300 UTM device) 
• default configurations are the rule rather than the exception; in fact, a fair number of small businesses use default configurations in complete ignorance or because they are afraid to alter configurations for fear of breaking something

My initial response to Laura was “You’re spot on when you say "something like Zeus can destroy a small business" but honestly, it doesn't take a Zeus in most cases.” Mulling the Zeus scenario a second time, particularly having watched the webinar, I think the threat is as worrisome as Laura suggests. Small businesses look like a sweet spot for financial abuse, having more capital than individual bank customers and less access to the types of detection and countermeasures larger organizations can acquire from companies like Silvertail Systems.

I also worry that the configuration agility Zeus introduces has broader applications than attacks financials. I’m thinking specifically of healthcare. If you really want a healthcare scare, run a security audit on your typical medical practice office network or NFP hospice. I have and they are not pretty. From experience, I’ll speculate that many of the attributes I mentioned earlier are commonplace among the typical physician, hospice, laboratory or diagnostic testing facilities you visit. I don't sleep well some nights thinking about the offices of physicians who manage my family’s care whose networks I haven't been invited to check. I’ll sleep even less now worrying that Zeus could be configured to target healthcare insurance providers.